Red Hat Subscription-Manager Local Privilege Escalation via D-Bus Auth Bypass
CVE-2023-3899 Published on August 23, 2023
Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
Vulnerability Analysis
CVE-2023-3899 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Timeline
Reported to Red Hat.
Made public. 28 days later.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVE-2023-3899 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2023-3899
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-3899 are published in these products:
Affected Versions
Red Hat Enterprise Linux 7:- Version 0:1.24.52-2.el7_9 and below * is unaffected.
- Version 0:1.28.36-3.el8_8 and below * is unaffected.
- Version 0:1.28.36-3.el8_8 and below * is unaffected.
- Version 0:1.25.17.1-2.el8_1 and below * is unaffected.
- Version 0:1.26.22-2.el8_2 and below * is unaffected.
- Version 0:1.26.22-2.el8_2 and below * is unaffected.
- Version 0:1.26.22-2.el8_2 and below * is unaffected.
- Version 0:1.28.13-7.el8_4 and below * is unaffected.
- Version 0:1.28.13-7.el8_4 and below * is unaffected.
- Version 0:1.28.13-7.el8_4 and below * is unaffected.
- Version 0:1.28.29.1-2.el8_6 and below * is unaffected.
- Version 0:1.29.33.1-2.el9_2 and below * is unaffected.
- Version 0:1.29.26.2-2.el9_0 and below * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.